Hacker News Reader

Comment by jfroma | Hacker News Reader

You can run a dnsmasq locally with "--stop-dns-rebind".

I have this enabled on my router.

dnsmasq has many other uses like tunneling all your DNS traffic through dnscrypt (https://www.opendns.com/about/innovations/dnscrypt/)

Ubiquiti router owners (I know there are a few on HN) can enable this option like so:

  ssh <router>
  configure
  set service dns forwarding options stop-dns-rebind
  commit
  save

/var/log/dnsmasq.log should contain the resolution failures after that. e.g.:

  Sep  1 21:48:41 dnsmasq[26479]: possible DNS-rebind attack detected: www.dropboxlocalhost.com